From: Frédéric Buclin <LpSolit@gmail.com>
Date: Mon, 25 Apr 2016 21:39:02 +0000 (+0200)
Subject: Bug 1259881 - CSV export vulnerable to formulae injection (again)
X-Git-Tag: release-5.0.3~5
X-Git-Url: http://git.ipfire.org/gitweb/gitweb.cgi?a=commitdiff_plain;h=8b0d558c0a41a25eb4b8047fb20d760cb2dc22dd;p=thirdparty%2Fbugzilla.git

Bug 1259881 - CSV export vulnerable to formulae injection (again)
r=sgreen a=dkl
---

diff --git a/Bugzilla/Template.pm b/Bugzilla/Template.pm
index 8104f6f1fe..41b9265c65 100644
--- a/Bugzilla/Template.pm
+++ b/Bugzilla/Template.pm
@@ -865,12 +865,13 @@ sub create {
             },
 
             # In CSV, quotes are doubled, and any value containing a quote or a
-            # comma is enclosed in quotes. If a field starts with an equals
-            # sign, it is proceed by a space.
+            # comma is enclosed in quotes.
+            # If a field starts with either "=", "+", "-" or "@", it is preceded
+            # by a space to prevent stupid formula execution from Excel & co.
             csv => sub
             {
                 my ($var) = @_;
-                $var = ' ' . $var if substr($var, 0, 1) eq '=';
+                $var = ' ' . $var if $var =~ /^[+=@-]/;
                 # backslash is not special to CSV, but it can be used to confuse some browsers...
                 # so we do not allow it to happen. We only do this for logged-in users.
                 $var =~ s/\\/\x{FF3C}/g if Bugzilla->user->id;